- Added optional secret-protected /jsonapi/routes feed for SSG/build-time route enumeration
- Secrets moved out of config exports (state by default; optional settings.php overrides)
- Update hook migrates any existing secrets out of config
This release updates documentation to clarify authenticated JSON:API usage (Basic/OAuth/JWT), caching behavior (anonymous-only caching for /jsonapi/resolve), and CSRF considerations for cookie-based writes. No functional code changes.